> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hiloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# agent-sandbox Helm chart

> Kubernetes controller for Hiloop sandbox workloads

Kubernetes controller for Hiloop sandbox workloads.

Source chart version `0.1.0`. Published OCI artifacts use the immutable version from
the deployment release record:

```bash theme={null}
helm install agent-sandbox oci://<your-registry>/charts/agent-sandbox \
  --version "${PUBLISHED_CHART_VERSION:?set to the immutable OCI version for this release}"
```

## Values

Keys marked `*` are required. Defaults are the chart's `values.yaml`; the deployment
sets the rest.

| Key                                      | Type                                  | Default                                                                                                                                                                                               | Description                                                                                                                                                                                          |
| ---------------------------------------- | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `affinity`                               | `object`                              | `{"podAntiAffinity": {"requiredDuringSchedulingIgnoredDuringExecution": [{"labelSelector": {"matchLabels": {"app.kubernetes.io/name": "agent-sandbox"}}, "topologyKey": "kubernetes.io/hostname"}]}}` | Additional controller pod affinity rules; the default keeps the two replicas on separate nodes.                                                                                                      |
| `containerSecurityContext`               | `object`                              | `{"privileged": false, "allowPrivilegeEscalation": false, "readOnlyRootFilesystem": true, "capabilities": {"drop": ["ALL"]}}`                                                                         | Controller container security context.                                                                                                                                                               |
| `controller`                             | `object`                              | —                                                                                                                                                                                                     | Controller-runtime behavior. Leader election, core-only mode, and auto-suspension support are fixed on; listeners are fixed at metrics 8080, health 8081, webhook 9443, and internal lifecycle 8090. |
| `controller.cacheLabelSelectors` \*      | `boolean`                             | `true`                                                                                                                                                                                                | Restricts Pod and Service caches to controller-owned objects.                                                                                                                                        |
| `controller.clusterDomain` \*            | `string`                              | `"cluster.local"`                                                                                                                                                                                     | Kubernetes DNS cluster domain used for webhook certificates. (non-empty)                                                                                                                             |
| `controller.sandboxConcurrentWorkers` \* | `integer`                             | `100`                                                                                                                                                                                                 | Maximum concurrent Sandbox reconciliations. (min 1, max 1000)                                                                                                                                        |
| `controller.webhookServiceName` \*       | `string`                              | `"agent-sandbox-webhook-service"`                                                                                                                                                                     | Service name embedded in generated webhook certificates.                                                                                                                                             |
| `enabled`                                | `boolean`                             | —                                                                                                                                                                                                     | Umbrella condition flag (the hiloop chart's Chart.yaml condition agent-sandbox.enabled). Has no effect in a standalone install.                                                                      |
| `fullnameOverride`                       | `string`                              | `"agent-sandbox-controller"`                                                                                                                                                                          | Full override for generated resource names.                                                                                                                                                          |
| `global`                                 | `object`                              | —                                                                                                                                                                                                     | Values shared across Hiloop charts.                                                                                                                                                                  |
| `global.imagePullSecrets`                | `array`                               | `[]`                                                                                                                                                                                                  | Image pull secrets attached to controller pods.                                                                                                                                                      |
| `global.imageRegistry`                   | `string`                              | `""`                                                                                                                                                                                                  | Registry prefix used to relocate the controller image.                                                                                                                                               |
| `global.sizing`                          |                                       | `"medium"`                                                                                                                                                                                            | Shared controller size preset.                                                                                                                                                                       |
| `image`                                  | `object`                              | —                                                                                                                                                                                                     | Patched controller image identity.                                                                                                                                                                   |
| `image.digest` \*                        | `string`                              | `""`                                                                                                                                                                                                  | Required immutable SHA-256 image digest.                                                                                                                                                             |
| `image.pullPolicy` \*                    | `Always` \| `IfNotPresent` \| `Never` | `"IfNotPresent"`                                                                                                                                                                                      | Kubernetes image pull policy.                                                                                                                                                                        |
| `image.repository` \*                    | `string`                              | `"ACCOUNT.dkr.ecr.REGION.amazonaws.com/hiloop/agent-sandbox-controller"`                                                                                                                              | OCI repository containing the controller image. (non-empty)                                                                                                                                          |
| `image.tag` \*                           | `string`                              | `""`                                                                                                                                                                                                  | Optional human-readable image tag; the digest remains authoritative.                                                                                                                                 |
| `nameOverride`                           | `string`                              | `""`                                                                                                                                                                                                  | Partial override for generated resource names.                                                                                                                                                       |
| `nodeSelector`                           | `object`                              | `{}`                                                                                                                                                                                                  | Node labels required by controller pods.                                                                                                                                                             |
| `podAnnotations`                         | `object`                              | `{}`                                                                                                                                                                                                  | Additional pod annotations.                                                                                                                                                                          |
| `podLabels`                              | `object`                              | `{}`                                                                                                                                                                                                  | Additional controller pod labels.                                                                                                                                                                    |
| `podSecurityContext`                     | `object`                              | `{"runAsNonRoot": true, "runAsUser": 65532, "runAsGroup": 65532, "fsGroup": 65532, "fsGroupChangePolicy": "OnRootMismatch", "seccompProfile": {"type": "RuntimeDefault"}}`                            | Pod-level security context.                                                                                                                                                                          |
| `rbac`                                   | `object`                              | —                                                                                                                                                                                                     | Controller RBAC settings.                                                                                                                                                                            |
| `rbac.create` \*                         |                                       | `true`                                                                                                                                                                                                | Creates the least-privilege core Sandbox RBAC rules.                                                                                                                                                 |
| `replicaCount`                           | `integer` \| `null`                   | `null`                                                                                                                                                                                                | Explicit controller replica count; null uses the size preset. (min 1)                                                                                                                                |
| `resources`                              | `object` \| `null`                    | `null`                                                                                                                                                                                                | Explicit controller resource requests and limits; null uses the size preset.                                                                                                                         |
| `serviceAccount`                         | `object`                              | —                                                                                                                                                                                                     | Controller ServiceAccount settings.                                                                                                                                                                  |
| `serviceAccount.annotations` \*          | `object`                              | `{}`                                                                                                                                                                                                  | Additional ServiceAccount annotations.                                                                                                                                                               |
| `serviceAccount.create` \*               |                                       | `true`                                                                                                                                                                                                | Creates the required controller ServiceAccount.                                                                                                                                                      |
| `sizing`                                 |                                       | `""`                                                                                                                                                                                                  | Chart-local controller size preset; empty inherits global.sizing.                                                                                                                                    |
| `terminationGracePeriodSeconds`          | `integer`                             | `30`                                                                                                                                                                                                  | Grace period for leader handoff during termination. (min 1)                                                                                                                                          |
| `tolerations`                            | `array`                               | `[]`                                                                                                                                                                                                  | Taints tolerated by controller pods.                                                                                                                                                                 |